Great course! This not only helps me in forensics but also in creating use-cases for our other intrusion analysis tools.

Joseph Murray, Deloitte

I was surprised and amazed at how easy it is to do memory analysis and how helpful it is.

Brian Dugay, Apple

ADVANCED THREATS ARE IN YOUR NETWORK - IT'S TIME TO GO HUNTING!

FOR508: Advanced Incident Response and Threat Hunting Course will help you to:

Detect how and when a breach occurred

Identify compromised and affected systems

Determine what attackers took or changed

Contain and remediate incidents

Develop key sources of threat intelligence

Hunt down additional breaches using knowledge of the adversary

DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won't tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.

This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization's networks. Organizations can't afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.

The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization. For the incident responder, this process is known as "threat hunting". Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.

The course uses a hands-on enterprise intrusion lab - modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network - to lead you to challenges and solutions via extensive use of the SIFT Workstation collection of tools.

During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.

During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.

GATHER YOUR INCIDENT RESPONSE TEAM -

IT'S TIME TO GO HUNTING

FOR508 Incident Response and Threat Hunting Course Topics

Advanced use of a wide range of best-of-breed open-source tools in the SIFT Workstation to perform incident response and digital forensics.

Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists.

Threat hunting techniques that will aid in quicker identification of breaches.

Rapid incident response analysis and breach assessment.

Incident response and intrusion forensics methodology.

Remote and enterprise incident response system analysis.

Windows live incident response.

Memory analysis during incident response and threat hunting.

Detailed instruction on Windows enterprise credentials and how they are compromised.

Course Syllabus

FOR508.1: Advanced Incident Response & Threat Hunting

Overview

There are ways to gain an advantage against the adversaries targeting you -- it starts with the right mindset and knowing what works.

Incident responders and threat hunters should be armed with the latest tools, memory analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries and to remediate incidents. Incident response and threat hunting analysts must be able to scale their analysis across thousands of systems in their enterprise. This section examines the six-step incident response methodology as it applies to an enterprise's response to a targeted attack. We will show the importance of developing security intelligence to impact the adversaries' "kill chain". We will also demonstrate live response techniques and tactics that can be applied to a single system and across the entire enterprise.

Enterprise scanning techniques are now a requirement to track targeted attacks by an APT group or organized crime syndicates that can rapidly propagate through hundreds of systems. Responding to this many systems cannot be accomplished using the standard "pull the hard drive" forensic examination methodology. Such an approach will alert the adversaries that you are aware of them and may allow them to adapt quickly and exfiltrate sensitive information in response.

Students will receive a full six-month license of F-Response Enterprise Edition, enabling them to use their workstation or the SIFT workstation to connect to hundreds or thousands of systems in the enterprise. This capability is used to benchmark, facilitate, and demonstrate new incident response technologies that enable a responder to look for indicators of compromise across the entire enterprise.

FOR508.2: Memory Forensics in Incident Response & Threat Hunting

Overview

During an intrusion, using memory analysis sometimes feels like cheating - finding active malware shouldn't be this easy.

Now a critical component of many incident response and threat hunting teams that detect advanced threats in their organization, memory forensics has come a long way in just a few years. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, and advanced malware used by an APT group of attackers. Traditionally, memory analysis was solely the domain of Windows internals experts, but the recent development of new tools makes it accessible today to anyone, especially incident responders and threat hunters. Better interfaces, documentation, and built-in detection heuristics have greatly leveled the playing field. This extremely popular section will introduce some of the most capable tools available and give you a solid foundation to add core and advanced memory forensic skills to your incident response and forensics capabilities.

Exercises

Detect unknown live and dormant custom malware in memory across multiple systems in an enterprise environment

Find APT "beacon" malware over common ports used by targeted attackers to access command and control (C2) channels

Find residual attacker command-line activity through scanning strings in memory and by extracting command history buffers

Compare compromised system memory against a baseline system using Frequency of Least Occurrence techniques

FOR508.3: Intrusion Forensics

Overview

Attackers are sloppy - they leave footprints everywhere. Learn the secrets of the best hunters.

Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker's action leaves a corresponding artifact, and understanding what is left behind as footprints can be critical to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish its objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious actions. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish this part of their mission. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.

Exercises

Hunting and detecting evidence of execution with Shimcache

Shimcache memory RAM examinations

Prefetch carving and extraction from memory and unallocated space

Finding evil in RecentFileCache and Volume Shadow copies

Hunting and tracking lateral movement with event log analysis

Discovering credential abuse with event log extraction and analysis

CPE/CMU Credits: 6

Topics

Advanced Evidence of Execution Detection

Application Compatibility Cache

Prefetch and Shimcache Extraction via Memory

RecentFileCache

Amcache

Window Shadow Volume Copy Analysis

Volume Shadow Copy Analysis Options

Raw and Live Shadow Copy Examination Using the SIFT Workstation

Integrating Shadow Copy Analysis into Investigations

Targeted Shadow Copy Analysis

Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)

Stealing and Utilization of Legitimate Credentials

Compromising Credentials Techniques

Remote Desktop Services Misuse

Windows Admin Shares Abuse

PsExec Utilization

Windows Remote Management Tool Techniques

PowerShell Remoting/WMIC Hacking

Vulnerability Exploitation

Event Log Analysis for Incident Responders and Hunters

Profiling Account Usage

Tracking and Hunting Lateral Movement

Identifying Suspicious Services

Detecting Rogue Application Installation

Finding Malware Execution and Process Tracking

Capturing Command Lines and Scripts

Anti-Forensics and Event Log Clearing

FOR508.4: Timeline Analysis

Overview

Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response...forever.

Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data are located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and Internet history files all contain time data that can be correlated into critical analysis to successfully solve cases. Pioneered by Rob Lee in 2001, timeline analysis has become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations of a multitude of time-based artifacts. The analysis that once took days now takes minutes.

This section will step you through the two primary methods of building and analyzing timelines created during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create a timeline and also how to introduce the key methods to help you use those timelines effectively in your cases.

Overview

Advanced adversaries are good. We must be better.

Over the years, we have observed that many incident responders and threat hunters have a challenging time finding threats without pre-built indicators of compromise or threat intelligence gathered before a breach. This is especially true in APT adversary intrusions. This advanced session will demonstrate techniques used by first responders to identify malware or forensic artifacts when very little information exists about their capabilities or hidden locations. We will discuss techniques to help funnel possibilities down to the candidates most likely to be evil malware trying to hide on the system.

Exercises

Track which systems the targeted attackers laterally moved to in the enterprise and how they transitioned from system to system so easily without being detected

Understand how an APT group can acquire domain admin rights in a locked-down environment

CPE/CMU Credits: 6

Topics

Evolution of Incident Response Scripting

WMIC

PowerShell

Incident Response Triage Investigations with PowerShell

Malware and Anti-Forensic Detection

NTFS Filesystem Analysis

Master File Table (MFT) Critical Areas

NTFS System Files

NTFS Metadata Attributes ($Standard_Information, $Filename, $Data)

Rules of Windows Timestamps for $StdInfo and $Filename

NTFS Timestamps

Resident versus Nonresident Files

Alternate Data Streams

Directory Listings and the $I30 file

Transaction Logging and the $Logfile and $UsnJrnl

What Happens When Data Is Deleted from an NTFS Filesystem?

Anti-Forensic Detection Methodologies

MFT Anomalies

Timeline Anomalies

Deleted File

Deleted Registry Keys

File Wiping

Adjusting Timestamps

Identifying Compromised Hosts without Active Malware

Rapid Data Triage Analysis

Cyber Threat Intelligence and Indicators of Compromise Searching

Evidence of Persistence

Super-timeline Examination

Packing/Entropy/Executable Anomaly/Density Checks

System Logs

Memory Analysis

Malware Identification

FOR508.6: The APT Incident Response Challenge

Overview

This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in a case that simulates an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other systems the adversary moved to laterally, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating realistic attacks, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hactivist groups.

CPE/CMU Credits: 6

Topics

The Intrusion Forensic Challenge will ask each incident response team to analyze multiple systems in an enterprise network.

During the challenge, each incident response team will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:

IDENTIFICATION AND SCOPING:

1. How and when did the APT group breach our network?

2. List all compromised systems by IP address and specific evidence of compromise.

3. When and how did the attackers first laterally move to each system?

CONTAINMENT AND THREAT INTELLIGENCE GATHERING:

4. How and when did the attackers obtain domain administrator credentials?

5. Once on other systems, what did the attackers look for on each system?

7. Determine what was stolen: Recover any .rar files or other archives exfiltrated, find encoding passwords, and extract the contents to verify extracted data.

8. Collect and list all malware used in the attack.

9. Develop and present security intelligence or an indicator of compromise for the APT-group "beacon" malware for both host- and network-based enterprise scoping. What specific indicators exist for the use of this malware?

REMEDIATION AND RECOVERY

10. Do we need to change the passwords for every user in the domain or just the ones affected by the systems compromised?

11. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?

a. What systems need to be rebuilt?

b. What IP addresses need to be blocked?

c. What countermeasures should we deploy to slow or stop these attackers if they come back?

d. What recommendations would you make to detect these intruders in our network again?

Additional Information

Laptop Required

!!!!! IMPORTANT - BRING YOUR SYSTEM CONFIGURED USING THESE DIRECTIONS !!!!!

As your core operating system, you can use any 64-bit version of Windows, Apple OS X, or Linux that also can install and run VMware virtualization products.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether your host supports 64-bit guest virtual machines. For further troubleshooting, this article provides good instructions for Windows users to determine more about the CPU and OS capabilities.

Please download and install VMware Workstation 11 or VMware Fusion 7 or higher versions on your system before class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.

MANDATORY FOR508 SYSTEM HARDWARE REQUIREMENTS:

CPU: 64-bit Intel i5 x64 2.0+ GHz (4th generation or above) processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

RAM: 8 GB (Gigabytes) of RAM minimum (Note: Operating with less than 8GB of RAM will prevent you from experiencing all of the labs in the course!)

Host Operating System: Fully patched and updated Windows (7+), Apple OS X (10.10+), or a recent version of Linux operating system (released 2014 or later) that can install and run VMware virtualization products (VMware Workstation 11 or VMware Fusion 7). Please note: It is necessary to fully update your host operating system before the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices. Those who use a Linux host must also be able to access ExFAT partitions using the appropriate kernel or FUSE modules.

Networking: Wireless 802.11 B, G, N, or AC; Ethernet is also nice to have, if possible.

USB 3.0 Port(s) - highly recommended

150 Gigabytes of free space on your system hard drive. Free space on the hard drive is critical! Consider bringing a USB3 external hard drive as a backup in case space becomes an issue. Not having enough hard drive space is one of the most common issues students have with their laptops.

Students should have local Administrator access within the host operating system and administrative access to the system's BIOS or equivalent pre-boot firmware

PLEASE NOTE: Do NOT use the version of the SIFT Workstation downloaded from the Internet. We will provide a custom FOR508 version specifically configured for training on Day 1 of the course.

MANDATORY FOR508 SYSTEM SOFTWARE REQUIREMENTS (Please install the following before the beginning of the class):

Bring/install any other forensic tool you feel could be useful (EnCase, FTK, etc). For the final challenge at the end of the course, you can utilize any forensic tool, including commercial capabilities, to help you and your team. If you have any dongles, licensed software, you are free to use them.

Again, DO NOT use the version of the SIFT Workstation downloaded from the Internet. We will provide you with a version specifically configured for the FOR508 materials on Day 1 of the course.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Who Should Attend

Incident Response Team Members who regularly respond to complex security incidents/intrusions from APT groups/advanced adversaries and need to know how to detect, investigate, remediate, and recover from compromised systems across an enterprise.

Threat Hunters who are seeking to understand threats more fully and how to learn from them in order to more effectively hunt threats and counter their tradecraft.

Red Team Members, Penetration Testers, and Exploit Developers who want to learn how their opponents can identify their actions, how common mistakes can compromise operations on remote systems, and how to avoid those mistakes. This course covers remote system forensics and data collection techniques that can be easily integrated into post-exploit operating procedures and exploit- testing batteries.

SANS FOR408 and SEC504 Graduates looking to take their skills to the next level.

Prerequisites

FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. We do not cover the introduction or basics of incident response, Windows digital forensics, or hacker techniques in this course.

We recommend that you should have a background in one of the following SANS courses: SEC504, FOR500, or equivalent training.

What You Will Receive

SIFT Workstation

This course extensively uses the SIFT Workstation to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks.

Identify lateral movement and pivots within your enterprise, showing how attackers transition from system to system without detection.

Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment.

Track data movement as the attackers collect critical data and shift them to exfiltration collection points.

Recover and analyze archives and .rar files used by APT-like attackers to exfiltrate sensitive data from the enterprise network.

Use collected data to perform effective remediation across the entire enterprise.

Hands-on Advanced Persistent Threat Enterprise Intrusion Lab

One of the biggest complaints you hear in the digital forensics, threat hunting, and incident response community is the lack of realistic intrusion data. Most real-world intrusion data are simply too sensitive to be shared.

The FOR508 course authors created a realistic scenario based on experiences surveyed from a panel of responders who regularly combat targeted APT attacks. They helped review and guide the targeted attack "script" used to create the scenario. The result is an incredibly rich and realistic attack scenario across multiple enterprise systems. This APT attack lab forms the basis for training during the week. The network was set up to mimic a standard "protected" enterprise network using standard compliance checklists:

Press & Reviews

"THIS WAS PROBABLY THE MOST COMPREHENSIVE AND USEFUL OF ALL THE TRAINING I HAVE EVER RECEIVED BY SANS." - DoD Student, USAF

"THE SANS508 COURSE EXCEEDED MY EXPECTATIONS IN EVERY WAY. IT PROVIDED ME THE SKILLS, KNOWLEDGE, AND TOOLS TO EFFECTIVELY RESPOND TO AND HANDLE APTS AND OTHER ENTERPRISE WIDE THREATS." -Josh Moulin NSTEC/NNSA/DOE

"THE EXAMPLES IN THE COURSE RELATE TO WHAT I NEED TO KNOW TO DEAL WITH REAL WORLD THREATS." -Tim Weaver, Digital Mtn. Inc.

"I WAS SURPRISED AND AMAZED AT HOW EASY IT IS TO DO MEMORY ANALYSIS AND HOW HELPFUL IT IS." - Brian Dugay, Apple

"THE LEVEL OF DETAIL IS AMAZING. THE METHODOLOGY IS CLEARLY EFFECTIVE AT FINDING PERTINENT ARTIFACTS." - Anonymous

"I'VE TAKEN OTHER NETWORK INTRUSION CLASSES BUT NOTHING THIS IN-DEPTH. THE CLASS IS OUTSTANDING!" - Craig Goldsmith, FBI

"GREAT COURSE! THIS NOT ONLY HELPS ME IN FORENSICS BUT ALSO IN CREATING USE-CASES FOR OUR OTHER INTRUSION ANALYSIS TOOLS." -Joseph Murray, Deloitte

"IT IS HARD TO REALLY SAY SOMETHING THAT WILL PROPERLY CONVEY THE AMOUNT OF MENTAL GROWTH I HAVE EXPERIENCED THIS WEEK." -Travis Farral, XTI Energy

"EXCELLENT COURSE, INVALUABLE HANDS-ON EXPERIENCE TAUGHT BY PEOPLE WHO NOT ONLY KNOW THE TOOLS AND TECHNIQUES, BUT KNOW THEIR QUIRKINESS THROUGH PRACTICAL, REAL-WORLD EXPERIENCE." -John Alexander, US Army

"THIS COURSE (FOR508) REALLY TAKES YOU FROM 0-60 IN UNDERSTANDING THE CORE CONCEPTS OF FORENSICS, ESPECIALLY THE FILE SYSTEM." -Matthew Harvey, U.S. Department of Justice

"IF YOU NEED TO TRACK DOWN WHAT HAPPENED IN YOUR ENVIRONMENTS, THIS IS A MUST HAVE COURSE!" -Fran Moniz, American National Insurance

"BEST FORENSICS TRAINING I'VE HAD SO FAR. I THOUGHT THE SOME OTHERS COURSES WERE GREAT BUT 508 IS A LOT MORE CURRENT AND APPLICABLE TO THE REAL WORLD! EXCELLENT COURSE AND INSTRUCTOR OVERALL!" -Marc Bleicher, Bit9

"THE MORE I PROGRESS THROUGH THE COURSE, THE MORE I REALIZE JUST HOW MUCH CAPACITY THERE IS TO PRODUCE ANSWERS TO TOUGH QUESTIONS. WHERE I MIGHT NOT HAVE FOUND SUPPORTING EVIDENCE IN PAST CASES, I FEEL I HAVE SO MANY NEW AVENUES TO EXPLORE. A REAL EYE-OPENER. I ALSO GREATLY APPRECIATE THE FOCUS ON INCIDENT RESPONSE." - Dave Ockwell-Jenner, SITA

"I HAVE ALREADY USED SEVERAL OF THE TOOLS/TECHNIQUES FROM THE COURSE WITH PAST-CASE EVIDENCE TO UNCOVER THINGS I DID NOT PREVIOUSLY KNOW." - Dave Ockwell-Jenner, SITA

"MY SOC FOCUSES A LOT ON INCIDENT RESPONSE AND QUICK FORENSICS, SO THE COURSE MATERIAL IS EXTREMELY VALUABLE." - Anonymous

"I ROUTINELY PERFORM LIVE MEMORY CAPTURES AND HAVE GONE THROUGH THEM LOOKING FOR THE OBVIOUS, BUT I HAD NO IDEA, UNTIL FOR508, HOW MANY ARTIFACTS ARE CONTAINED IN RAM." - M Scott Saul, FBI

"THE SANS INSTITUTE IS CURRENTLY THE LEADER IN THE COMMERCIAL IR AND COMPUTER FORENSIC TRAINING MARKET. THEY HAVE A LARGE NUMBER OF QUALITY COURSES." - Luttgens, Jason; Pepe, Matthew; Mandia, Kevin. Incident Response & Computer Forensics, Third Edition - July 2014

"YOU HAVE THE CONTENT WHICH IS CLOSE TO REAL WHEN YOU HAVE THE INSTRUCTOR THAT GOES INTO A LOT OF REAL WORLD EXAMPLES. JUST GREAT." - Anonymous

Statements From Our Authors

"In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, 'There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.' They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.

"In other words, the enemy is getting better and bolder, and their success rate is impressive.

"We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best."

- Rob Lee

"We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimble in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.

We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others' experiences and develops the necessary skills to take you to the next level."

- Chad Tilbury

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.